CVE-2026-35210: OpenCTI Authorization Bypass via Synchronized-Upsert Header

Technical summary

The vulnerability exploits insufficient server-side validation of the synchronized-upsert header in OpenCTI's STIX object handling logic. Attackers with KNOWLEDGE_KNUPDATE permission can inject this header to bypass authorization checks that normally enforce Confidence Level and Object Marking constraints. The flaw affects STIX objects including Indicators, ThreatActors, Malware, and Reports. By manipulating these objects, an attacker can downgrade confidence ratings on threat data and remove or alter Object Markings—metadata that controls distribution and sensitivity classification. The issue is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization), indicating that the application trusts client-supplied synchronization directives without proper access control validation.

Business impact

This vulnerability directly undermines the security and trustworthiness of threat intelligence data within OpenCTI deployments. Authorized users—or attackers who have compromised low-privileged accounts—can degrade the operational value of intelligence by reducing confidence levels and stripping TLP and other marking restrictions. This exposes sensitive threat data to broader organizational visibility than intended, potentially leaking intelligence to unauthorized personnel or external systems. For security teams relying on OpenCTI as a central repository for threat correlation and analyst decision-making, the ability for insiders or compromised accounts to silently modify object markings creates both data integrity and confidentiality risks. The impact is amplified in organizations where TLP:RED or other restrictive markings are used to gate sensitive intelligence from third parties.

Affected systems

OpenCTI versions prior to 7.260326.0 are affected. The vulnerability requires the attacker to hold valid authentication credentials with KNOWLEDGE_KNUPDATE permission, which is typically assigned to analysts and threat intel operators. Any instance running an older version is at risk if users with this permission lack strict oversight or if account compromise occurs. Community and commercial deployments of OpenCTI are equally vulnerable.

Exploitability

Exploitation is straightforward: an authenticated attacker with KNOWLEDGE_KNUPDATE permission needs only to craft an HTTP request with the synchronized-upsert: true header when modifying STIX objects. No user interaction, social engineering, or complex exploit chains are required. The attack surface is internal to OpenCTI itself and does not require network access beyond what an authenticated user already possesses. However, the vulnerability is not unauthenticated—it requires a valid account. The CVSS score of 7.1 (HIGH) reflects the combination of low attack complexity, high integrity impact (ability to modify objects and markings), and confidentiality impact (exposure of intelligence via removed TLP markings).

Remediation

Upgrade OpenCTI to version 7.260326.0 or later. This version includes corrected authorization logic that validates Confidence Level and Object Marking restrictions regardless of HTTP headers. Organizations should verify the upgrade path for their deployment model (Docker, bare metal, cloud-hosted) and test in a staging environment before production deployment. During and after upgrade, review access control policies for KNOWLEDGE_KNUPDATE permissions to ensure they are assigned only to trusted personnel.

Patch guidance

Obtain and deploy version 7.260326.0 from the official OpenCTI release channels (GitHub, Docker Hub, or vendor repositories). Review the detailed changelog to confirm all authorization checks are included in the patch. Coordinate the upgrade during a maintenance window; the update should not require data migration or downtime beyond the service restart. After patching, verify that the synchronized-upsert header no longer bypasses validation by attempting to modify an object with Object Markings via an unprivileged account—the operation should fail.

Detection guidance

Monitor OpenCTI request logs for the synchronized-upsert header in HTTP requests, particularly those that modify STIX objects or Object Markings. Audit recent changes to Confidence Levels and TLP markings on Indicators, ThreatActors, Malware, and Reports; unexpected downgrades or removals of TLP:RED or similar restrictions may indicate exploitation. Check for accounts with KNOWLEDGE_KNUPDATE permission that have not been active recently or whose activity patterns have changed. Use endpoint detection and response (EDR) tools to monitor for unusual API calls or bulk object modifications from unexpected sources. Implement file integrity monitoring on OpenCTI database files if running on-premise to detect unauthorized mutations.

Why prioritize this

This vulnerability merits urgent but not emergency prioritization. It is a HIGH-severity privilege escalation that enables insider threats and compromised account abuse, but it requires authentication and does not allow remote code execution or complete data theft. Organizations should patch within the next 1–2 weeks, prioritizing instances where OpenCTI holds highly sensitive or classified threat intelligence, or where user access controls are weak. The lack of any known public exploitation (KEV status: false) provides a brief window to patch before adversaries actively exploit the flaw.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for Low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), partial confidentiality impact (C:L) from exposure of TLP-restricted data, and high integrity impact (I:H) from modification of confidence levels and markings. The score does not include availability impact because the vulnerability does not disrupt service. The HIGH severity rating is justified by the combination of data integrity and confidentiality degradation within a sensitive intelligence context.

Frequently asked questions